The withdrawal address allow-list
The address allow-list is an anti-theft control for withdrawals. When it’s on, the app will only send withdrawals to addresses you have explicitly saved and enabled — so even if someone gained access to your session, they couldn’t withdraw to an address you didn’t approve.
How it works
- You save trusted withdrawal addresses to your allow-list in Security.
- With the allow-list on, a withdrawal to any address that isn’t on the list is refused before it’s broadcast.
The asymmetric timing (this is the point)
Turning protection up is instant; turning it down is slow — on purpose.
- Enabling the allow-list, or adding a new trusted address, takes effect immediately.
- Disabling the allow-list (removing the protection) is delayed by a set waiting period before it takes effect.
That delay means an attacker can’t simply switch the protection off and drain your funds in one session — you have a window to notice and react.
You’re notified of every change
Every change to your allow-list or its state sends you a critical Telegram message. If you ever get one of these notifications and it wasn’t you, act immediately: your account may be compromised.
Recommended setup
- Add the address(es) you actually withdraw to (your exchange, your cold wallet).
- Turn the allow-list on.
- Leave the disable-delay as configured — the wait is your safety margin.
Related protections
The allow-list is one layer. Withdrawals to a new address also require confirmation with your PIN or Face ID, and every account has withdrawal limits. Together these mean moving money out always requires something only you have.
Was this article helpful?
Thanks for the feedback.